Anthony Reinke » account http://www.anthonyreinke.com Rambling Thoughts of a Random Mind Wed, 01 Feb 2012 22:03:42 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Searching for Account Lockouts with Splunk http://www.anthonyreinke.com/2009/12/21/searching-for-account-lockouts-with-splunk/ http://www.anthonyreinke.com/2009/12/21/searching-for-account-lockouts-with-splunk/#comments Mon, 21 Dec 2009 22:03:47 +0000 Anthony Reinke http://www.anthonyreinke.com/?p=170 This requires that the Splunk agent is getting the security event from the Domain Controller(s).

  1. Find the username of the person
  2. Log in to the Splunk server.
  3. Click on the Search button.
  4. Enter the search paramitters to find the user and select your time frame for the search:
    source=”WinEventLog:Security” User_Name=”lockedUser”
  5. Then check the “Client_Address” field.  This can be found on the left column.
  6. The client IP shows where the lockout came from.

1. Find the username of the person

2. Log in to the Splunk server.

3. Click on the Search button

4. Enter the search paramitters to find the user and select your time frame for the search:
source=”WinEventLog:Security” Type=”Failure Audit” User_Name=”lockedUser”

5. Then check the “Client_Address” field. This can be found on the left column

6. The client IP shows where the lockout came from.

]]> http://www.anthonyreinke.com/2009/12/21/searching-for-account-lockouts-with-splunk/feed/ 0